44net

44net@mailman.ampr.org

3196 discussions

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Steve L 07 Mar '16

07 Mar '16

Ronen, Feel free to use mine: http://44.92.21.1/tools/ These tools reside on my gateway (IPIP not BGP) and it does have a DNS entry so it should be accessible from the world wide internet as well as 44net. I have a ip route lookup tool, so you can see what my local routing table has for a return route. 73 Steve KB9MWR >Hi there > >I have unexplained 44 net routing problem > >There are some gateways i can reach from my 44 net address and others not ... > >I can access any of my 44 net equipment from any non 44 net IP with no problem > >the Encap text is most updated.... > >The gateways i cant reach are accessible from their non AMPRNET side > >I need a tool (beside this one http://44.60.44.10 ) to be able to do traceroute and ping to me and > to other 44 net > >Is there anyone that have such a thing open for the public (or willing to give me access ) on his >machine (that sit on 44 net IP via tunnel (not via BGP) ? > >Please Advice > >Thanks Forward > >Ronen - 4Z4ZQ > >http://www.ronen.org

1 0

Re: [44net] OpenVPN
by Steve L 07 Mar '16

07 Mar '16

Thanks Tal.. I'll be looking forward to the email. It should help. >Hello, >The time here is 23:53 and i'm not next to my computer. >Tomorrow I'll send configuration file for the openvpn server and one to the >client, also i have script that generate key files & config files for >clients. > >Sorry that i can't send them now. > >Regards, >Tal. > >> Brian, thanks for the update. >> >> I know I asked before on how to build openvpn server keys and other >> configuration details that will let a openvpn server I build work with >> any hams lotw key clients that has previously documented: >> >> http://wiki.ampr.org/wiki/AMPRNet_VPN >> >> This is what I have built my own generated certificate authority, >> server keys, with before using the >> >> ./clean-all >> ./build-ca >> ./build-key-server server >> ./build-key client1 >> ./build-dh >> >> I could really use something detailed on the values for the keys and >> certificates parameters to make a server work with the lotw based keys >> >> Its not clear to me where one gets the the LoTW root CA certificate(s) >> that need to be installed on the server. And I assume these are >> Diffie hellman parameters? >> >> Steve

1 0

Is there raceroutre machine on 44 net available for public ?
by R P 07 Mar '16

07 Mar '16

Hi there I have unexplained 44 net routing problem There are some gateways i can reach from my 44 net address and others not ... I can access any of my 44 net equipment from any non 44 net IP with no problem the Encap text is most updated.... The gateways i cant reach are accessible from their non AMPRNET side I need a tool (beside this one http://44.60.44.10 ) to be able to do traceroute and ping to me and to other 44 net Is there anyone that have such a thing open for the public (or willing to give me access ) on his machine (that sit on 44 net IP via tunnel (not via BGP) ? Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org

2 1

Misconfiguration of gateway tunnel interfaces
by Rob Janssen 07 Mar '16

07 Mar '16

> I've been observing the following: > a. - gateways sending RFC1918 addresses in the inside header (e.g. > 192.168.11.0/24) Unfortunately it is very common. Not only on IPIP tunnels but also on other connections we have (OpenVPN, IPsec tunnels, radio access points). Some weeks ago I mentioned it on the list, the sender claimed he would act on it, but it just continues. Unfortunately not many users understand iptables well enough to just block invalid traffic on their own gatewat and even fewer are actively monitoring their equipment so they would notice they are sending stuff like this and receiving "prohibited" replies all the time :-( I would recommend amprnet operators starting a network analyzer on your network (like wireshark) every time you have made a configuration change, added some equipment, or just have a few minutes of time to spend. It will teach you a lot and make the other operators happy. Rob

3 2

OpenVPN
by Rob Janssen 06 Mar '16

06 Mar '16

> Phil has dropped the project. I doubt he'll take it up again. > - Brian Why? It was quite easy to implement on our gateway. And I did some extra work to make it easier for me to maintain, else it would have been even simpler. Maybe there were other reasons? Rob

4 4

OpenVPN
by Rob Janssen 06 Mar '16

06 Mar '16

> I suspect they were personal reasons; Phil has retired from networking > entirely and between battling cancer and turning his remaining time to > teaching high-school students about science and engineering, I know he's > not interested in AMPRNet anymore. He said so when we had dinner a few > weeks ago. > - Brian I'm sorry to hear that... please send him my best wishes when you have contact with him. It is his work that made the AMPRNet possible in the early days... Rob

1 0

Re: [44net] OpenVPN?
by Steve L 06 Mar '16

06 Mar '16

About 5 years ago I thought I read that Phil Karn was working on getting OpenVPN implemented on the AMPRGW. Is there a status update on that? The reason I ask is once again, I have a situation where we could really use some sort of statefull way to connect some HSMM links. There is always a lot of arm twisting needed to convince folks who are donating us an internet connection that we need access to the firewall to forward ports for IRLP and the like. Steve

2 1

Cisco config questions
by Martin A Flynn 06 Mar '16

06 Mar '16

We are finally setting up the gateway at N2MO - the plan is to use an existing Cisco 2811 Integrated Services Router for AMPRnet. After reading the config notes at: http://wiki.ampr.org/wiki/Setting_up_a_gateway_on_Cisco_Routers , I had several questions 1) For the FQDN of the commercial internet connection, is there an accepted naming convention ? 2) Our 2811 ISR has both serial and Ethernet WIC (WIC-2T and HWIC-2FE). Is there any benefit to using the serial connection? 73 Martin A Flynn / W2RWJ Ocean-Monmouth Amateur Radio Club, Inc 2300 Marconi Road Wall Township, NJ 07719 Tel: +01 732-428-7373 Email: mflynn(a)n2mo.org Visit us online at: www.n2mo.org

2 1

Doing IPIP with Ubiquiti ?
by R P 06 Mar '16

06 Mar '16

Hi there I started to config my Bullet2 to be access point for delivering the AMPRNET to the HAMS and saw that there is tunnel and ipip in the commands Does it mean it support by default IPIP tunneling and can serve as Gateway ? I couldn't succeeded to find the correct syntax of the command whatever i have done it gave me error that something is "garbage" Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

2 6

GRE over IPsec tunnel in Linux
by Rob Janssen 05 Mar '16

05 Mar '16

On our gateway system we try to offer tunneling technologies that are easily usable on the equipment the users have available. For example, we deployed OpenVPN because it is so easy for the users to install and use. For use on routers like MikroTik, IPsec is more convenient. We offer IPsec tunnels for subnets and individual addresses, in AH and ESP mode, and the latter also over NAT-T. A number of users have such a tunnel working over NAT-T without problem. We use setkey/racoon. To connect a radio network router that uses BGP to provide it with a fallback in case the radio network is down or when it has not yet been deployed, it is more convenient to use a GRE tunnel over IPsec transport. BGP can then consider the GRE tunnel as an alternative path. This is easily configurable on a MikroTik in ESP mode, but AH is also possible. (AH mode uses less CPU because there is no encryption, only authentication) After deploying some GRE over IPsec transport connections, of course the first site appeared who has the MikroTik router behind a NAT router which cannot be removed. GRE over IPsec transport does not work over NAT. So, I researched the matter and found that there are examples of the use of GRE over IPsec tunnel mode, which in turn can operate over NAT-T (when ESP is used). Of course terribly inefficient in terms of header size, but it should work. Ok, back to the configuration drawing board and implement this on the Linux gateway. I cannot get it to work. The whole IPsec tunnel is established correctly (of course, this already worked), I can add the GRE interface and make it use the tunnel, but when GRE traffic comes in on the IPsec tunnel it does not appear on the GRE interface. Which worked fine when using IPsec transport instead of tunnel. When I ping from the gateway to a connected test router (MikroTik), I can see the pings arrive on the GRE interface there, being returned to the gateway, arrive as ESP-over-UDP, matched in the firewall, sent to an iptables entry that matches on protocol 47, I can even dump them to the log with -j LOG where they appear: Mar 5 18:23:43 gw-44-137 kernel: [17858.781986] IN=eth0 OUT= MAC=00:0c:29:cc:5a:2a:dc:38:e1:f6:2f:f0:08:00 SRC=10.0.1.43 DST=10.11.12.13 LEN=148 TOS=0x00 PREC=0x00 TTL=255 ID=81 DF PROTO=47 The corresponding GRE tunnel with these addresses is present, it works in the outgoing direction, but not incoming. My guess is that it is a problem to match the SRC and DST addresses in an IPsec tunnel packet to the remote and local addresses of a GRE interface, and it never finds its way. Probably the wrong addresses are matched, the outside rather than the inside addresses of the IPsec tunnel. Does anyone have experience with this and know what might be the problem and how it can be fixed? The Linux kernel is version 3.2.0 (Debian Wheezy) in case that matters. Rob

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net